Ensure user sessions persist correctly and securely across the platform

Implements CORS and updates AuthContext to manage user authentication via cookie-based sessions.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 8fac8604-8776-4090-bf16-1e3d01acb719
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9777c70b-fc38-4831-8d6b-78dfffe041b0/e43769e0-ea3b-4deb-b53a-a84e46de587b.jpg

client/src/context/AuthContext.tsx

@@ -27,10 +27,21 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
   const checkAuthStatus = async () => {
     try {
-      const currentUser = await authService.getCurrentUser();
+      const response = await fetch('/api/auth/me', {
-      setUser(currentUser);
+        credentials: 'include',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      });
+      
+      if (response.ok) {
+        const data = await response.json();
+        setUser(data.user);
+      } else {
+        setUser(null);
+      }
     } catch (error) {
-      // User not authenticated
+      console.warn('Auth check failed:', error);
       setUser(null);
     } finally {
       setIsLoading(false);

server/index.ts

@@ -5,6 +5,21 @@ import { setupVite, serveStatic, log } from "./vite";
 
 const app = express();
 app.set('trust proxy', true);
+
+// CORS configuration for authentication
+app.use((req, res, next) => {
+  res.header('Access-Control-Allow-Credentials', 'true');
+  res.header('Access-Control-Allow-Origin', req.headers.origin);
+  res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
+  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With');
+  
+  if (req.method === 'OPTIONS') {
+    res.sendStatus(200);
+  } else {
+    next();
+  }
+});
+
 app.use(express.json());
 app.use(express.urlencoded({ extended: false }));
 

test_cookies.txt

@@ -0,0 +1,5 @@
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+#HttpOnly_localhost	FALSE	/	FALSE	1749480636	connect.sid	s%3Aj7g6cTWTz7BCYrKu889ssWBXcXcW1o64.OY0iia0%2B%2Bpuriroxk01ON7%2FX%2FqMAS0NBpglNNJ0a%2F6M